Hackers exploit gaps in African card payments. Here's how we're closing the gaps with tokenisation

The continent's card market is growing fast, but sophisticated cybercriminals learn just as quickly, enabling them to bypass new systems. Across CEMEA, friction and fraud remain real challenges, with payment issues accounting for up to 44% of digital transaction abandonment.

In response to these challenges, we announced in February 2026 that we had become one of the first prepaid card processors in CEMEA to support Visa digital wallet tokenisation, making it possible to replace sensitive card data with secure digital tokens.

Visa reports that, in 2024, tokenisation drove a 30% reduction in fraud and a 6% improvement in payment approvals. And within two weeks of production enablement for UBA Benin, we saw that 1% of their cardholders had already tokenised their cards during the pilot verification.

Just how big is Africa's card market?

Here are two questions to ponder when next you’re standing in line at the grocery store or your favourite morning snack spot:

• How many times do you hear the phrase “tap or insert” in a month?
• How many online transactions will you settle this year by typing in your card number, its expiry date and a three- or four-digit verification code? 

It’s entirely possible that you’ve lost count: the convenience and ease of “tap/swipe/double click” can’t be beaten and, while cash remains a popular payment method in the majority of African countries, the continent’s card market is growing fast. 

For instance, Nigeria’s prepaid card market (cards preloaded with funds for a specific use and not tied to an account), which stood at US$9.20 billion in 2023, has been forecast to reach US$20.16 billion by 2028. And in South Africa, the value of card payments grew by 10.3% in 2024, hitting R2.7 trillion; an analytical report by GlobalData projected that it would reach R2.9 trillion by 2025. 

This growth has been driven by several innovations such as the rapidly improving interoperability between card systems and other payment options like mobile money, and card solutions that are tailor-made for African consumers rather than being copied and pasted from other markets.

Why are cards vulnerable to hackers?

There are three main types of payment cards: debit cards that mirror bank accounts, prepaid cards that are preloaded with funds, and credit cards for a credit line with a financial institution.

According to Grace Anyetei, Onafriq's Regional General Manager for Southern and East Africa, the weak point in card payments is rarely the card itself.

All these types of cards can be used for domestic and international ecommerce and point of sale (POS) payments. The challenge usually comes in when a customer uses a card on a site, maybe booking a flight, for example, and their laptop or phone gets compromised through phishing or other means used by hackers.

 

How does card tokenisation work?

Anyetei explains how tokenisation offers a powerful layer of protection for card transactions, replacing the real card number with a stand-in that fraudsters can't use.

“When you get a card, you get a card number - let’s call this an F-CARD. When a customer opts to add their card to digital wallets like Apple Pay or Samsung Pay, or a mobile money wallet turns their wallet into an NFC (near field communication, which enables contactless transactions) wallet, the card automatically gets tokenised.”

This, she says, happens thanks to a series of API calls happening in the backend: “Visa through VTS or Mastercard through MDES takes that F-CARD and stores it in a ‘safety deposit box’. Then they issue a digital card (D-CARD) with a token instead of a card number for the user to add to their digital wallets so that they can pay without worry of fraud. The token is useless to fraudsters.”

This approach to card safety is working well. Visa reports that, in 2024, tokenisation drove a 30% reduction in fraud and a 6% improvement in payment approvals.

What's next?

Anyetei acknowledges that these services aren’t available in all the markets covered by this certification - but here, too, Onafriq is innovating: “If Apple Pay or Google Pay is not available in a  particular country in Africa, we can sort that out by turning a bank or digital wallet app into an app that can hold the tokenised card.”